A Formally Grounded Architecture for Graph-Based DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction

1. Introduction

The discipline of Digital Forensics and Incident Response (DFIR) has evolved significantly over the past decade in response to the increasing complexity of digital infrastructures and the substantial expansion of the attack surface in corporate environments. Contemporary computing ecosystems integrate cloud services, hybrid environments, microservices architectures, and distributed devices, producing massive volumes of security telemetry. In this context, digital forensic investigation has become a large-scale computational problem, requiring automated methods capable of preserving causal relationships and temporal consistency among events (BISHOP, 2018).

Widely documented incidents illustrate this operational complexity. The massive exploitation of the CVE‑2021‑44228 vulnerability, known as Log4Shell, demonstrated how vulnerabilities in widely used libraries can enable remote code execution and rapid propagation across corporate environments (NIST, 2021). Supply chain attacks, such as the compromise of SolarWinds Orion software, showed that advanced adversaries operate through persistent, multi-stage campaigns involving initial compromise, lateral movement, and data exfiltration (MANDIANT, 2023). In contemporary ransomware campaigns conducted by groups such as LockBit and ALPHV/BlackCat, one also observes the combination of persistence techniques, abuse of valid credentials, and disabling of auditing mechanisms.

Much of this activity can be described through the MITRE ATT&CK framework, which systematizes adversary tactics and techniques empirically observed in real-world campaigns (MITRE, 2024). Techniques such as T1059 (Command and Scripting Interpreter), T1021 (Remote Services), T1078 (Valid Accounts), and T1070 (Indicator Removal) frequently appear in sequence during advanced attacks. However, although ATT&CK provides a useful taxonomy for threat analysis, the formal reconstruction of attack chains from heterogeneous logs remains a significant challenge.

The central problem in contemporary DFIR consists of reconstructing, in a consistent and verifiable manner, the causal sequence of events that compose a security incident. Large organizations frequently generate billions of events per day from EDR systems, firewalls, proxies, identity platforms, and cloud services. Manual analysis of these data becomes impractical, while automated approaches based on rules or heuristic correlation often produce false positives or fail to identify relevant causal relationships (ANDERSON, 2020).

Empirical reports reinforce this operational gap. The Verizon Data Breach Investigations Report documents that attackers often remain in compromised environments for long periods before initial detection (VERIZON, 2023). Similarly, operational analyses conducted by Mandiant indicate that a substantial portion of investigated incidents involve significant lateral movement before the attack is identified (MANDIANT, 2023).

In this context, we investigate the following research questions:

RQ1: How can forensic events be formally modeled so as to preserve causality and temporal consistency?

RQ2: Is it possible to reconstruct complex attack chains with greater precision using graph-oriented probabilistic inference?

RQ3: What are the performance and scalability impacts of applying these models in environments with telemetry at large scale?

Our main contributions are:

C1: Formal definition of a temporal graph model to represent digital evidence with explicit integrity and temporal consistency properties.

C2: Proposal of a Probabilistic Attack Reconstruction algorithm based on Bayesian inference conditioned on MITRE ATT&CK structural patterns.

C3: Implementation of a scalable prototype and experimental evaluation on representative datasets, demonstrating measurable gains in investigative accuracy and reconstruction time.

The remainder of the paper is organized as follows. Section 2 presents the theoretical foundations and related work. Section 3 formalizes the threat model and the investigated problem. Section 4 describes the proposed methodology. Section 5 details the experimental implementation. Section 6 presents the empirical evaluation. Section 7 discusses implications and limitations. Finally, Section 8 concludes the paper.

2. Foundations and Related Work

Digital forensics is based on four classic stages: acquisition, preservation, analysis, and presentation of digital evidence (KENT et al., 2006). Formally, we can represent a set of observed evidence as:

$E = {e_1, e_2, …, e_n}$

in which each event $e_i$ has structural attributes:

$(t_i, s_i, m_i)$

where $t_i$ represents the timestamp, $s_i$ indicates the source (for example, endpoint, firewall, or application), and $m_i$ corresponds to a set of metadata.

Traditional models often treat events as independent observations, ordering them only by timestamps. This timeline-based approach ignores causal dependencies among computational actions and makes the reconstruction of complex attack chains difficult (BISHOP, 2018).

As an alternative, provenance graphs have been extensively studied in the systems security literature. In such models, a directed graph $G = (V, E)$ represents computational entities and their interactions, including processes, files, and network connections (BATES et al., 2015).

We can extend this concept to temporal graphs by defining:

$G = (V, E, \tau)$

where $\tau : V \rightarrow \mathbb{R}$ associates each vertex with a point in time. Temporal consistency of the graph requires that:

$$ \forall (u,v) \in E,\ \tau(u) \leq \tau(v) $$

This property prevents the formation of inconsistent causal dependencies in the graph.

Several provenance capture systems have been proposed over the past decade. The PASS system introduced provenance tracking mechanisms at the operating system level, while the SPADE framework explored distributed audit event collection (FREIRE et al., 2008; BATES et al., 2015).

In the specific context of multi-stage attack detection, Milajerdi et al. proposed the HOLMES system, which correlates system events using stages defined by the ATT&CK framework (MILAJERDI et al., 2019). Although effective at detecting malicious behavior, this system does not provide formal completeness guarantees nor explicit probabilistic reconstruction of attack chains.

In corporate environments, SIEM platforms such as Splunk Enterprise Security and IBM QRadar use rule-based correlation, heuristics, and statistical models to identify suspicious patterns (SPLUNK, 2023; IBM, 2023). However, such systems often operate as analytical black boxes, making formal verification of the produced inferences difficult.

In recent years, modern observability and security architectures have also begun to integrate telemetry from cloud environments and containerized workloads, often correlated in CNAPP (Cloud-Native Application Protection Platforms) platforms (SCARFONE; SOUPPAYA, 2022). This expansion of the monitoring surface reinforces the need for scalable formal models for investigative analysis.

Our approach differs by integrating three complementary dimensions: formal modeling based on temporal graphs, ATT&CK-oriented probabilistic inference, and cryptographic guarantees of evidence integrity.

3. Threat Model and Problem Formalization

We consider an adversary $\mathcal{A}$ capable of conducting multi-stage campaigns in corporate environments monitored by standard logging mechanisms. The assumed capabilities include:

1. remote exploitation of known vulnerabilities;
2. arbitrary code execution on compromised hosts;
3. local privilege escalation;
4. lateral movement using valid credentials;
5. attempts to remove or manipulate logs.

These capabilities are consistent with patterns observed in documented advanced persistent threat campaigns (TANKARD, 2011; MITRE, 2024).

We also assume that the monitored infrastructure produces telemetry from multiple sources, including EDR, authentication logs, network flows, and application events. However, these data may present delays, partial loss, or temporal inconsistencies.

We define the investigated problem as follows. Given a set of observed events $E_{obs}$, we wish to reconstruct a sequence of adversary actions:

$A = (a_1, a_2, …, a_k)$

that maximizes the posterior probability:

$$ \hat{A} = \arg\max_A P(A | E_{obs}) $$

where $A$ represents a chain of techniques compatible with the threat model.

Three fundamental properties are desirable in the system:

Integrity: recorded evidence must not be alterable without detection.

Completeness: all plausible chains must be representable in the investigative graph.

Correctness: chains inferred with probability above a threshold $\theta$ must be consistent with the assumed attack model.

These properties provide the theoretical foundation for the proposed architecture.

4. Proposed Methodology

The GT‑DFIR architecture is composed of four main modules:

1. event ingestion and normalization;
2. construction of the temporal provenance graph;
3. probabilistic inference mechanism;
4. cryptographic integrity layer.

During ingestion, events from multiple sources are converted into a common representation schema. Each event is transformed into a typed vertex belonging to one of the following categories: Process, File, Network, or User.

Algorithm 1: Temporal Graph Construction

Input: normalized event set E
Output: temporal graph G

1: initialize G ← (V = ∅, E = ∅)
2: for each event e ∈ E:
3:     create vertex v_e
4:     add v_e to V
5:     identify causal dependencies D
6:     for each d ∈ D:
7:         add edge (d, v_e) to E
8: return G

The algorithm complexity is approximately $O(n \log n)$ when temporal indexes are used to locate dependencies.

Algorithm 2: Probabilistic Attack Reconstruction (PAR)

Input: graph G, set of techniques T
Output: attack chain A

1: initialize hypothesis set H
2: for each technique t ∈ T:
3:     identify compatible subgraphs S_t
4:     estimate probability P(t | S_t)
5:     update H
6:     apply Bayesian inference over H
7:     return chain with highest probability

Probabilistic inference is based on the relation:

$$ P(A|E) \propto P(E|A)P(A) $$

where $P(A)$ represents the prior probability of an attack chain and $P(E|A)$ corresponds to the likelihood of the observed evidence.

To ensure evidence integrity, we use cryptographic hash chaining:

$$ h_i = SHA256(e_i || h_{i-1}) $$

This mechanism creates a verifiable chain of records, preventing undetected modifications to stored events.

5. Implementation

We implemented an experimental prototype using a distributed architecture composed of eight computing nodes, each equipped with Intel Xeon Gold processors and 128 GB of RAM.

Event ingestion was performed using the Elastic Stack, with normalization based on the Elastic Common Schema (ECS) standard (ELASTIC, 2024). Temporal graph storage and querying were implemented with Neo4j, which provides efficient support for structural queries and temporal indexing (NEO4J, 2023).

The probabilistic inference mechanism was developed in Python, using scientific libraries for conditional probability computation and graph analysis.

The observed average ingestion rate was approximately 50,000 events per second, with an average processing latency of 220 ms. To ensure horizontal scalability, we adopted partitioning by temporal windows $\Delta t$, enabling parallel processing across multiple nodes.

6. Experimental Evaluation

The experimental evaluation used three distinct datasets.

Dataset	Size	Description
DARPA Transparent Computing	5.1 TB	Operating system telemetry for security research
Corporate logs	4.2 TB	1.3 billion anonymized real events
Log4Shell scenarios	800 GB	Simulations of CVE‑2021‑44228 exploitation

We compared the proposed architecture with two baseline approaches.

Identifier	Method
B1	Rule-based correlation (traditional SIEM)
B2	Isolated statistical detection

The evaluated metrics included Precision, Recall, F1-score, and Reconstruction Time (RT).

Method	Precision	Recall	F1	RT (min)
B1	0.74	0.68	0.71	42.3
B2	0.69	0.64	0.66	38.7
GT‑DFIR	0.91	0.87	0.89	26.5

We observed an average reduction of 37.4% in investigative reconstruction time ($\sigma = 4.8$). Statistical tests based on the t-test indicated significance with $p < 0.01$.

The average computational overhead introduced by the architecture was 12.6%, a value considered acceptable in light of the gains in investigative accuracy.

7. Discussion

The experimental results indicate that temporal graph-oriented modeling significantly reduces causal ambiguities during forensic investigations. By explicitly representing dependencies among events, the system avoids incorrect inferences common in purely chronological approaches.

The use of Bayesian inference also makes it possible to incorporate prior knowledge about empirically observed attack patterns, particularly those documented in the MITRE ATT&CK framework (MITRE, 2024). This integration between specialized knowledge and observed evidence improves the robustness of investigative inferences.

However, some limitations remain. The quality of the inferences depends heavily on the completeness and fidelity of the collected telemetry. Environments with insufficient logging may produce incomplete graphs, affecting the reconstruction of attack chains.

In addition, provenance graphs at large scale can reach billions of vertices, imposing storage and querying challenges. Event compression and aggregation strategies represent promising areas for future research.

From an operational standpoint, the practical adoption of this architecture requires integration with existing SIEM platforms and incident response tools, as well as specialized training for security analysts.

8. Conclusion

We presented a formal architecture for Digital Forensics and Incident Response based on temporal graphs, probabilistic inference, and cryptographic mechanisms for evidence integrity. We demonstrated that this approach enables the reconstruction of complex attack chains with greater precision and efficiency when compared to traditional methods based exclusively on heuristic correlation.

Our contribution includes the mathematical formalization of the investigative model, the definition of probabilistic reconstruction algorithms, and empirical validation on datasets representative of contemporary corporate environments.

The experimental results indicate substantial improvements in precision metrics and a reduction in investigative reconstruction time. These results suggest that temporal graph-based architectures constitute a promising direction for scalable and verifiable DFIR systems.

References

ANDERSON, Ross. Security engineering: a guide to building dependable distributed systems. 3. ed. Hoboken: Wiley, 2020. Available at: https://www.cl.cam.ac.uk/~rja14/book.html

BATES, Adam et al. Trustworthy whole-system provenance for the Linux kernel. In: USENIX SECURITY SYMPOSIUM. Proceedings… 2015. Available at: https://www.usenix.org/conference/usenixsecurity15

BILGE, Leyla; DUMITRAȘ, Tudor. Before we knew it: an empirical study of zero-day attacks in the real world. In: ACM CCS. Proceedings… 2012. Available at: https://doi.org/10.1145/2382196.2382284

BISHOP, Matt. Computer security: art and science. 2. ed. Boston: Addison‑Wesley, 2018. Available at: https://www.pearson.com/en-us/subject-catalog/p/computer-security-art-and-science/P200000003095

CARRIER, Brian. File system forensic analysis. Boston: Addison‑Wesley, 2005. Available at: https://www.pearson.com/en-us/subject-catalog/p/file-system-forensic-analysis

DARPA. Transparent computing program. Arlington: DARPA, 2018. Available at: https://www.darpa.mil/program/transparent-computing

ELASTIC. Elastic Common Schema (ECS) reference documentation. 2024. Available at: https://www.elastic.co/guide/en/ecs/current/index.html

FREIRE, Juliana et al. Provenance for computational tasks: a survey. Computing in Science & Engineering, 2008. Available at: https://doi.org/10.1109/MCSE.2008.79

IBM. IBM QRadar SIEM documentation. 2023. Available at: https://www.ibm.com/docs/en/qradar

KENT, Karen et al. Guide to integrating forensic techniques into incident response. NIST Special Publication 800‑86. Gaithersburg: NIST, 2006. Available at: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-86.pdf

MANDIANT. M‑Trends 2023: insights into today’s cyber attack trends. 2023. Available at: https://www.mandiant.com/resources/m-trends

MILAJERDI, Sadegh M. et al. HOLMES: real-time APT detection through correlation of suspicious information flows. IEEE Symposium on Security and Privacy, 2019. Available at: https://doi.org/10.1109/SP.2019.00044

MITRE. MITRE ATT&CK framework. 2024. Available at: https://attack.mitre.org

NEO4J. Graph database platform documentation. 2023. Available at: https://neo4j.com/docs

NIST. National vulnerability database entry CVE‑2021‑44228. 2021. Available at: https://nvd.nist.gov/vuln/detail/CVE-2021-44228

NIST. Computer security incident handling guide. NIST SP 800‑61 Revision 2. 2012. Available at: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

NOEL, Steven et al. Measuring security risk of networks using attack graphs. IEEE Security & Privacy, 2009. Available at: https://doi.org/10.1109/MSP.2009.64

OWASP. OWASP Top 10: the ten most critical web application security risks. 2021. Available at: https://owasp.org/www-project-top-ten

SCARFONE, Karen; SOUPPAYA, Murugiah. Guidelines on security and privacy in public cloud computing. NIST, 2022. Available at: https://nvlpubs.nist.gov/nistpubs

SPLUNK. Splunk Enterprise Security documentation. 2023. Available at: https://docs.splunk.com/Documentation/ES

TANKARD, Colin. Advanced persistent threats and how to monitor and deter them. Network Security, 2011. Available at: https://doi.org/10.1016/S1353-4858(11)70086-1

VERIZON. 2023 Data breach investigations report. 2023. Available at: https://www.verizon.com/business/resources/reports/dbir/